Subject: RE: [mobile-ip] fastv6 and CoAs

From: "Mohan Parthasarathy" <[email-masked]>
Date: Tue, 24 Sep 2002 10:03:49 -0700

James,

> 
> > => We're revisting this I think, how does it
> > know that K is who it claims to be? HI/HACK
> > are irrelevant. We all know that there is a
> > _real_ K on the link, but there is no proof that
> > the packet arriving at the AR's interface is coming
> > from K. We already agreed that addresses and MAC
> > addresses can be spoofed. So how can you know that
> > the packet came from K and not from some other
> > node pretending to be K?
> > This is how /64 spoofing is opened up.
> >
> 
> Right, that's what I said. Ingress filtering does not stop 
> someone spoofing a legitimate address, nor spoofing an 
> address with a legitmate prefix. So, in that sense, it won't 
> stop an attacker from using an address X:Y, where Y is the 
> host identifier for a legitimate node on the link using the 
> prefix _for which the router is performing ingress filtering_.
> 
> It's the same way with K. Anybody can spoof K's address, but 
> they can't spoof another address with H as a prefix.
> 
> Solving this problem is what SEND is about.
> 
I am not sure I understood how SEND would solve this. A totally
different node on the link is sourcing packets with source address
"K" without doing any neighbor discovery. Assuming it is a shared
medium, I am not sure how the Access Router can detect this. 
What am I missing ?

-mohan

>             jak

---

From: "James Kempf" <[email-masked]>
Date: Tue, 24 Sep 2002 20:44:30 -0700

Mohan,

You are right, it wouldn't.

I meant that it would solve the problem of a host claiming to be X:Y, where Y is
the host identifier for a legitimate node on the subnet using the prefix X,
which the router is routing.

In the case of K, which is being source routed, the router can check the MAC
address, which is also sent along with the HI. If the MAC layer is so insecure
that the MAC address can be spoofed, then the router SHOULD send a RA
immediately to force the MN to change its care of address if there is indication
of an attack. Once the MN has an address on the subnet, SEND can be used to
verify it.

            jak

----- Original Message -----
From: "Mohan Parthasarathy" <[email-masked]>
To: "James Kempf" <[email-masked]>; "Hesham Soliman (EAB)"
<[email-masked]>; <[email-masked]>
Sent: Tuesday, September 24, 2002 10:03 AM
Subject: RE: [mobile-ip] fastv6 and CoAs

James,

-mohan